Twenty-one countries have signed a voluntary accord in Paris controlling commercially available hacking tools. The accord, called the Pall Mall Process or Code of Practices for States, had been in development for over a year before finally being signed.
According to the French Ministry of Digital Affairs, the accord is based on four pillars — accountability, precision, transparency, and oversight. It also issued some recommendations to curb the active spread of spyware around the world, including banning vendors who illegally sell or spread spyware, introducing regulations to control governmental use of spyware, creating policies defining the appropriate use of the technology, and protecting human rights in the process.
At the moment, the following countries have signed the accord:
- Austria
- Denmark
- Estonia
- France
- Germany
- Ghana
- Greece
- Hungary
- Ireland
- Italy
- Japan
- Kosovo
- Luxembourg
- Moldova
- Netherlands
- Poland
- Slovakia
- Slovenia
- Switzerland
- United Kingdom
Some nations signing up for the accord are already suspected of being spyware users. Additionally, Israel, home of some of the world’s most notorious commercial spyware companies, isn’t a part of the accord either. The US, another global superpower, didn’t sign the agreement either. Paragon Solutions, an Israeli spyware vendor, recently confirmed that the US is, in fact, a spyware user.
The 13-page document published by the supporting nations isn’t the end of the initiative, either. The code claims that supporting countries intend to regularly review progress on implementing these “voluntary good practices” and improve accountability across the spyware market. There’s also talk of the code being updated with the latest developments in the spyware industry and threat landscape as a whole.
Commercial spyware has become a thorn in the side of journalists, activists, and just about anyone else raising their voice against a government. Even in 2025, there are reports of governments targeting journalists, activists, members of opposing political parties, and even regular citizens.
While some spyware companies claim to have policies to prevent the abuse of their products, there’s little visible action against offenders. That said, Cellebrite, another Israeli spyware giant, recently banned Serbia for misusing its equipment on activists and journalists.
In the News: 2 exploited Android vulnerabilities patched
